Release v???

[lukpueh]

• bump version in init.py
• add changelog entry

[jku]

Just so we remember:

This release should not happen

• until users of python-tuf have had time to update to tuf 4.0
• and maybe even until the main users of python-tuf have made a release

This is because especially tuf.ngclient users may not be direct securesystemslib users so may not pin the securesystemslib version.

[jku]

Just documenting some users:

• python-tuf 4.0 caps securesystemslib < 0.32
• tuf-on-ci 0.9 caps securesystemslib < 0.32
• root-signing-staging has upgraded to tuf-on-ci 0.9 so caps securesystemslib < 0.32
• sigstore-python main uses python-tuf 4.0, sigstore-python 2.1.5 caps securesystemslib
• rstuf apparently already pins securesystemslib

[lukpueh]

Just documenting some users:

• in-toto 2.3.0 caps securesystemslib < 0.32

[lukpueh]

Should we make this 1.0.0 already?

I submitted a host of PRs yesterday to remove all legacy code (#731). If we merge those, I think we are ready.

[jku]

I don't see why not, at least not immediately

[lukpueh]

Before we tag 1.0.0 we should remove disclaimers like this:

https://github.com/secure-systems-lab/securesystemslib/blame/main/docs/signer.rst#L62-L67

(there may be others)

[jku]

This is something I would have like before 1.0: securesystemslib/py.typed and complete annotations for public api

Notes on that

• leave _gpg and _vendor unannotated,

• this is still a lot of work because of how hash and formats are written -- I guess we could just annotate them with "Any" (with the idea that it's better to get signer annotations used even if hash and formats are not).

• there's still some missing annotations because we don't currently enable

    disallow_untyped_defs = True
    disallow_incomplete_defs = True
  

I think I would rather get a release out and then start improving that situation

[jku]

superseded by #807